Privacy Policy

This matters more than it sounds, because for most of the data on this platform we are not the organisation that decides what happens to it.

The certifying body, and your organisation, are the controllers

For candidate data — your enrolment, your attempts, your results, your identity check-in and your supervision images — the certifying body whose exam you sit decides why it is collected and how long it is kept. If an organisation enrolled you (an employer, a university or a training provider), it decides too, for the data it manages. Requests about that data start with them.

We are the processor

We hold and process that data on their written instructions, under the Data Processing Agreement. We do not use it for our own purposes.

We are the controller for our own data

For visitors to this website, people who contact us, and the administrators of organisations we deal with commercially, we decide the purposes ourselves and this policy governs it directly.

Data protection contact: info@xamina.io. Our registration details are given on request.

Account and identity

• Name, email address, and the organisation you belong to.
• Your locale and timezone, so times and messages arrive in a form you can use.
• Authentication data: a salted hash of your password (never the password itself), session and device records, and the times and IP addresses of sign-ins.

Assessment

• Enrolments, bookings, attempts, the answers you gave, timings and your results.
• Certificates issued to you, including the serial number that makes them verifiable.

Identity check-in, where your exam requires it

• An image of an identity document you photograph.
• A photograph of your face taken at check-in.
• A mathematical face template derived from those images, used to compare one against the other. This comparison runs on our own servers.
• The name printed on the document, read so that your certificate carries your name exactly as it appears there.

Supervision, where your exam requires it

• Still images from your webcam during the sitting, and from your shared screen if screen supervision is on.
• Integrity events — the record that a signal was detected, when, and how serious it was rated.

Technical

• Server logs including IP address, browser and pages requested, kept for security and troubleshooting.
• Strictly necessary cookies for your session and for cross-site request protection. We do not use advertising cookies or third-party trackers on this site.

Where we are the controller, we rely on these lawful bases under UK GDPR Article 6:

• Contract — to provide the service to an organisation and to the people using its account.
• Legitimate interests — to keep the platform secure, prevent abuse, and respond to enquiries you send us.
• Legal obligation — to keep accounting records and to answer lawful requests.

Where the certifying body or your organisation is the controller, it is responsible for identifying its own lawful basis. Face images and face templates are biometric data used to identify you, which is special category data under Article 9. The controller must have an Article 9 condition for it — usually explicit consent — and must tell you before you sit. The platform shows you a supervision notice and records that you saw it; that record supports the controller’s accountability, it does not replace it.

If your exam is supervised, here is what actually happens while you sit.

• Your webcam takes still images at intervals. It is not a continuous video recording and there is no audio recording.
• If your organisation uses live supervision, an invigilator can join a call during your sitting and see your camera and shared screen and hear your microphone while it lasts.
• Those images are analysed for a fixed set of signals your organisation chose to switch on — for example a phone in view, your face not being present, a second person appearing, or your gaze leaving the screen.
• A signal your organisation has switched off is not analysed and no record of it is kept.
• When a signal is detected, an integrity event is recorded with the frame that triggered it.
• An AI review service (Google Gemini) then looks at that frame. If it is sure the signal was a false alarm, it closes it. The frame is kept for 30 days in case of an appeal, then deleted, unless the certifying body chose to delete it at once. Anything that may be cheating, or that it is not sure about, goes to a person.
• A detection is not a decision. Nobody is failed by the software. Your organisation reviews the evidence under its own misconduct process.

You may refuse. Refusing means you cannot sit a supervised paper, and what happens next is a matter between you and the certifying body or your organisation — talk to them, not to us.

We do not sell personal data, and we never will.

• The certifying body and your organisation. Administrators, invigilators and examiners at the certifying body whose exam you sit, and at the organisation that enrolled you, if any, can see your enrolment, attempts, results and any integrity events.
• Sub-processors. A short list of suppliers who host and run the service on our behalf, each under a written contract with the same obligations we owe you. The current list is in the Data Processing Agreement.
• Anyone verifying a certificate. A person holding your certificate serial can confirm it is genuine. The verification page shows only what is needed to confirm that — never your answers, your score breakdown or your supervision record.
• Authorities, where we are legally required to disclose. Unless we are prohibited, we will tell the controller first.

The map on Find a training provider is drawn from OpenStreetMap. Your browser loads the map images directly from the OpenStreetMap Foundation’s servers, so the Foundation receives your IP address and the technical details any browser sends with a request, such as its type. We send it nothing else, and its own privacy policy covers what it receives.

The directory never asks where you are, and it does not look up addresses.

An approved trainer’s public page is published only with the trainer’s consent, which they give when they agree to train with a training provider. They choose whether it shows their photo, bio, languages and LinkedIn, and they can hide the page at any time. A hidden page answers as if it never existed.

The page shows the name on their certificate, the courses they are approved for, which certifying body approved them, and whether each approval is valid, expired or suspended, never why. Search engines are asked not to index it unless the trainer allows them. Their name also appears on the page of each training provider they train with.

A listed training provider’s page shows its name and logo, its address or only its town if it prefers, a pin on the map, the courses it is approved for, its upcoming course dates, and the email address, phone number and website it confirmed for publication. It never shows the contact details the provider uses with us, and never a pass rate or a count of candidates.

A provider is listed only while its certifying body’s approval is current. Where a published detail names a person, such as a named email address, the provider can change or remove it at any time.

Candidate data is hosted in the EU. Where a sub-processor operates outside the UK or EEA, transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses, together with a transfer risk assessment.

Our outbound email is sent through Microsoft 365, so the contents of a message we send you — and your address — pass through that service.

Supervision frames and check-in photographs that need a second look are sent to Google’s Gemini service, under Google’s Data Processing Addendum and Standard Contractual Clauses. Google does not use them to train its models.

Our off-site backups are encrypted on our servers before they leave, and are stored with Backblaze in the EU. Backblaze cannot read them.

Where the certifying body or your organisation is the controller, it sets retention and can instruct us to delete sooner. Our defaults, applied unless instructed otherwise:

• Results and certificates — kept for the life of the account, because a qualification that cannot be re-verified is worthless. the life of the account
• Identity check-in images — deleted a month after the certificate is issued or the result is final, and never kept longer than 90 days.
• Supervision frames — the same rule as check-in images: deleted a month after the certificate is issued or the result is final, never later than 90 days. A false alarm’s image is kept for 30 days after it is closed, in case of an appeal, then deleted. The record of each flag stays.
• Audit and compliance events — 6 years, because they are the record that makes a result defensible.
• Server logs — 90 days.

Under UK GDPR you have the right to:

• Know what is held about you, and get a copy of it.
• Have inaccurate data corrected.
• Have data erased, where there is no overriding reason to keep it.
• Restrict or object to processing in certain circumstances.
• Receive data you gave us in a portable format.
• Withdraw consent, where consent is what the processing rests on.

Where to send the request. If you are a candidate, send it to the certifying body whose exam you sat, or to the organisation that enrolled you — they are the controller and we are obliged to act on their instruction, not to act around them. If you send it to us, we will pass it to them and tell you we have. For data where we are the controller, write to info@xamina.io and we will respond within one month.

You can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, but you do not have to.

Passwords are stored as salted scrypt hashes and are never recoverable. Sessions use rotating refresh tokens with reuse detection, so a stolen token invalidates the family it came from. Access between organisations is enforced in the data-access layer, on every query, rather than left to each screen.

Our internal information security policy, access control policy and incident response plan govern how our own staff handle your data. They are available to organisations under NDA during procurement.

If you believe you have found a vulnerability, write to info@xamina.io. Please do not test against live candidate data.

We will post any change here and update the review date at the top. Where a change materially affects how we handle personal data, we will notify account administrators by email before it takes effect.